1. Field
The invention relates to an input-output device of a control apparatus that monitors and controls a plant or field equipment, or more specifically to a safety output device provided with a self-diagnosis function.
2. Description of the Background
A safety control system required to be highly reliable, particularly, are now equipped with a control apparatus that monitors and controls a plant, field equipment, and the like and that has a self-diagnosis function to self-diagnose a failure of the control apparatus without human help.
FIG. 8 shows a configuration example of such a safety control system. In FIG. 8, a safety control system 100 includes, for example, an input terminal portion 12, such as a sensor, that detects a state of a control target 200 such as a nuclear power plant or field equipment, a control apparatus 11 that receives an output from the input terminal portion 12 as an input signal and generates an output signal to control an operation terminal portion 13, such as valve, in accordance with a pre-stored control program, and the operation terminal portion 13.
The control apparatus 11 includes an input device 11b that receives a signal from the input terminal portion 12 as an input signal, an arithmetic device 11a that calculates an arithmetic output corresponding to the input signal, and an output device 11c that sends the arithmetic output to the operation terminal portion 13.
Incidentally, a device integrally having the input device 11b and the output device 11c is sometimes referred to an input-output device or an I/O device, as well.
For example, recent safety equipment serving as the input terminal portion 12 and being connected to the control apparatus 11 such as a programmable logic controller (PLC) outputs a self-diagnosis pulse signal periodically for a self-diagnosis. The self-diagnosis pulse signal is an off signal which has an extremely short pulse width (e.g., 20 μsec). The safety equipment checks whether or not there is any anomaly in an output system by feeding the self-diagnosis pulse signal back to the safety equipment itself.
The PLC may erroneously take a self-diagnosis pulse signal as an operating signal into a main body in the PLC. In this context, Japanese Patent No. 4131134, for example, discloses a control apparatus capable of performing a stable sequence control even when being connected to an external device that outputs a self-diagnosis pulse signal, and also discloses an input circuit for the control apparatus and a signal input method for the control apparatus.
The input circuit according to Japanese Patent No. 4131134 sets an interval period which is known in advance as a period in which no self-diagnosis pulse signal is generated from the safety equipment, and separates an operation-output step signal from the self-diagnosis signal received from the external device, i.e., the safety equipment to take only the operation-output step signal into the main body of the control apparatus (PLC).
Meanwhile, Japanese Patent No. 3630583 discloses a method and an apparatus for online diagnosis of a fail-safe switch of safety equipment serving as the operating terminal potion 13.
In the meantime, Japanese Patent Application Publication No. 2007-66246 discloses a system and method for self-diagnosis of a controller including diagnosis execution means provided independently of a main processor in order to perform safety control and a highly accurate self-diagnosis at the same time.
In general, a self-diagnosis pulse signal, from a safety device, which is superimposed on signals from and to an input device and an output device of a control apparatus has a sufficiently smaller pulse width than those of normal input and output signals used for control so as to be distinguished from those normal input and output signals for control.
Incidentally, noise dependent on the installation environment of the control apparatus 11 interferes in an input line 100a connecting the input device 11b of the control apparatus 11 to the safety equipment such as the external input terminal portion 12, as well as in an output line 100b connecting the output device 11c of the control apparatus 11 to the safety equipment such as the external operating potion 13.
If the pulse width of a noise pulse caused by the noise and superimposed on signals on the input line 100a and the output line 100b is approximately equal to that of the self-diagnosis pulse signal, the self-diagnosis pulse signal cannot be distinguished from the noise pulse, causing a problem that a normal self-diagnosis cannot be performed.
As a countermeasure for the problem, the input device and the output device of a general safety control system are provided with noise filters on input terminals in order to remove the noise pulse having a pulse width equal to or smaller than that of the self-diagnosis pulse signal.
However, a noise removal method utilizing the frequency separation characteristics of the noise filter cannot completely separate foreign noise having wideband frequency components. Therefore, the method cannot distinguish unnecessary noise pulse signals from pulse signals which are generated due to a failure of the control target 200 or are generated as an indication of disconnection of any of the input line 100a and the output line 100b connecting the control apparatus 11 to the input terminal portion 12 and the operation terminal portion 13.
Accordingly, use of the noise filter may cause overlook of a pulse signal representing an indication of a failure, or false detection of a failure. Hence there is a problem that it is hard to detect errors of the input line 100a or the output line 100b. 
Meanwhile, if the output device 11c performs a self-diagnosis using a self-diagnosis pulse signal, the self-diagnosis pulse signal might be superimposed on a signal to be sent to the operation terminal portion 13 or rarely to the control target 200.
For this reason, the pulse width of the self-diagnosis pulse signal is normally set to such a short pulse width that the operation terminal portion 13 connected to the output device 11c may not respond to the self-diagnosis pulse signal. Nevertheless, there is a problem that the self-diagnosis pulse signal may adversely affect behaviors of the control target 200 depending on the response performance of the operation terminal portion 13.
Moreover, in the above-described method of Japanese Patent No. 4131134 which sets an interval period known in advance as a period in which no self-diagnosis pulse signal is generated from the safety equipment, and temporally separates the operation-output step signal from the self-diagnosis signal received from the external device, there is a problem that the safety control and the self-diagnosis of the input-output device cannot be executed in parallel or at any selected timing.